UbuntuUpdates.org

Package "dracut"

Name: dracut

Description:

Initramfs generator using udev
Latest version: 060+5-1ubuntu3.4
Release: noble (24.04)
Level: security
Repository: universe
Homepage: https://github.com/dracutdevs/dracut/wiki/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "dracut"

All arch deb package
APT INSTALL

Other versions of "dracut" in Noble

Repository Area Version
base universe 060+5-1ubuntu3
base main 060+5-1ubuntu3
security main 060+5-1ubuntu3.4
updates main 060+5-1ubuntu3.3
updates universe 060+5-1ubuntu3.3

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 060+5-1ubuntu3.4 2026-09-28 02:07:23 UTC

dracut (060+5-1ubuntu3.4) noble-security; urgency=medium

  * SECURITY UPDATE: Remote Code Execution
    - debian/patches/CVE-2026-15816-1.patch: feat(base): add escape function
      implementing printf %q in modules.d/99base/dracut-lib.sh.
    - debian/patches/CVE-2026-15816-2.patch: fix(base): sanitize message written
      by die() to the emergency hook in modules.d/99base/dracut-lib.sh.
    - CVE-2026-15816
  * SECURITY UPDATE: Remote Code Execution
    - debian/patches/CVE-2026-6893-1.patch: fix(network-legacy): sanitize DHCP
      values in dhclient-script.sh in modules.d/35network-legacy/dhclient-
      script.sh.
    - debian/patches/CVE-2026-6893-2.patch: fix(network-legacy): strip DHCP-
      supplied domain to a safe charset in modules.d/35network-legacy/dhclient-
      script.sh.
    - CVE-2026-6893

 -- John Breton Thu, 24 Sep 2026 13:28:12 -0400
CVE-2026-15816 A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory wit
CVE-2026-6893 A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Hos


About   -   Send Feedback to @ubuntu_updates